CVE-2024-28583

What it actually does

Buffer overflow in the readLine() function of FreeImage 3.19.0 when parsing XPM format images enables local arbitrary code execution with the privileges of the calling process.

Why it matters to the business

Attackers with local access can gain full control of affected systems, potentially leading to data theft, ransomware deployment, or lateral movement; the flaw affects AlmaLinux 8 systems using the listed libmbim packages and carries moderate urgency due to its age and lack of widespread exploitation evidence.

How an attack unfolds

An attacker prepares a malicious XPM image file that triggers the overflow in readLine(), places the file in a location read by the vulnerable library (for example via libmbim utilities), and causes the target process to open the image, resulting in code execution on the local system.

How to fix it

Upgrade libmbim and libmbim-utils on AlmaLinux 8 to version 1.26.0-2.el8 or later; rebuild or reinstall any dependent packages that embed the vulnerable FreeImage code; verify the update via package manager and restart affected services.

How to confirm the fix worked

Confirm the installed package versions match or exceed the fixed releases using rpm -q or dnf list; test by attempting to process a known-good XPM image after the update and monitor for crashes or unexpected behavior during image handling.

Typical attack path

1. Craft a malicious XPM image that overflows the readLine buffer
2. Place the image file in a location or workflow processed by libmbim or dependent utilities on AlmaLinux 8
3. Trigger the vulnerable code path by causing the process to read the image
4. Achieve arbitrary code execution with the privileges of the affected process

How to detect it

Review system logs and process execution history for unexpected crashes or code execution when libmbim utilities or dependent services handle image files; look for anomalous child processes spawned from image-parsing routines and correlate with file creation or access events involving .xpm files.

What your security team should do

• Apply the AlmaLinux 8 package updates immediately on all affected hosts
• Scan for any custom applications or scripts that invoke FreeImage or libmbim with untrusted XPM input
• Restrict local user access to image-processing workflows until patches are deployed
• Add package version checks to existing vulnerability scanning and compliance reporting